graphiti 1.2.20 → 1.2.28

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db3bae18176af83f5ac1b88c50546cefcf57f38245e69a5fcbb45f3028ca2273
-  data.tar.gz: 6ee077531421990da7d4fe80bedfada136b299420d7b82566e9261b7f1a2800a
+  metadata.gz: 62001af4fe0f26688b07d4f9e0565b2f2cd1e875fa299c982ef5986e9db66836
+  data.tar.gz: 28ba11c786c4e7eb7be0612c2bd678434156e667110623046438d6e1a1c9b67d
 SHA512:
-  metadata.gz: 0ceeabdfe64a03c4d709353a763a49224a14eb068633dcbd67c4ef2ee370dbdcd47781b0a4c15f19fe02956712aaca3dda42a17eb514bf44b821725261dc7ddf
-  data.tar.gz: d329a82610a68dec935625edbd502e85c39907a64261f170d342f632c82dc211c0fab440edbb16210483eb2154f44d403a2f13d5f3b9b7e41d4aafe68c66bf4a
+  metadata.gz: f5ed46d521816170aec5448ee816a5ea336faf791034c63c19a8bce64982d42ed9e19420b3d9e4f4782a78b20f8ba475636d920574b360d947991201eeb50bc8
+  data.tar.gz: f8578aa1f893d531146204cc43c142ddc58b4cc98a272e08c33ab13fd308530f04d4bdd273ef638ff88017f88051c44a9c76b0e1335a47c80ec9eee6b412d87b

data/Gemfile

@@ -3,8 +3,6 @@ source "https://rubygems.org"
 # Specify your gem's dependencies in graphiti.gemspec
 gemspec
 
-gem "standard", "0.4.7"
-
 group :test do
   gem "pry"
   gem "pry-byebug", platform: [:mri]

data/gemfiles/rails_4.gemfile

@@ -2,7 +2,7 @@
 
 source "https://rubygems.org"
 
-gem "rails", "~> 4.1"
+gem "rails", "~> 4.2"
 gem "rspec-rails"
 gem "sqlite3", "~> 1.3.6"
 gem "database_cleaner"

data/graphiti.gemspec

@@ -29,6 +29,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "kaminari", "~> 0.17"
   spec.add_development_dependency "bundler"
   spec.add_development_dependency "rake", "~> 10.0"
+  spec.add_development_dependency "standard", "0.4.7"
   spec.add_development_dependency "activemodel", ">= 4.1"
   spec.add_development_dependency "graphiti_spec_helpers", "1.0.beta.4"
 end

data/lib/graphiti/adapters/active_record.rb

@@ -1,7 +1,7 @@
 module Graphiti
   module Adapters
     class ActiveRecord < ::Graphiti::Adapters::Abstract
-      require "graphiti/adapters/active_record/inferrence"
+      require "graphiti/adapters/active_record/inference"
       require "graphiti/adapters/active_record/has_many_sideload"
       require "graphiti/adapters/active_record/belongs_to_sideload"
       require "graphiti/adapters/active_record/has_one_sideload"

data/lib/graphiti/adapters/active_record/belongs_to_sideload.rb

@@ -1,5 +1,5 @@
 class Graphiti::Adapters::ActiveRecord::BelongsToSideload < Graphiti::Sideload::BelongsTo
-  include Graphiti::Adapters::ActiveRecord::Inferrence
+  include Graphiti::Adapters::ActiveRecord::Inference
 
   def default_base_scope
     resource_class.model.all

data/lib/graphiti/adapters/active_record/has_many_sideload.rb

@@ -1,5 +1,5 @@
 class Graphiti::Adapters::ActiveRecord::HasManySideload < Graphiti::Sideload::HasMany
-  include Graphiti::Adapters::ActiveRecord::Inferrence
+  include Graphiti::Adapters::ActiveRecord::Inference
 
   def default_base_scope
     resource_class.model.all

data/lib/graphiti/adapters/active_record/has_one_sideload.rb

@@ -1,5 +1,5 @@
 class Graphiti::Adapters::ActiveRecord::HasOneSideload < Graphiti::Sideload::HasOne
-  include Graphiti::Adapters::ActiveRecord::Inferrence
+  include Graphiti::Adapters::ActiveRecord::Inference
 
   def default_base_scope
     resource_class.model.all

data/lib/graphiti/adapters/active_record/{inferrence.rb → inference.rb}

@@ -1,6 +1,6 @@
-module Graphiti::Adapters::ActiveRecord::Inferrence
+module Graphiti::Adapters::ActiveRecord::Inference
   # If going AR to AR, use AR introspection
-  # If going AR to PORO, fall back to normal inferrence
+  # If going AR to PORO, fall back to normal inference
   def infer_foreign_key
     parent_model = parent_resource_class.model
     reflection = parent_model.reflections[association_name.to_s]

data/lib/graphiti/adapters/active_record/many_to_many_sideload.rb

@@ -8,6 +8,18 @@ class Graphiti::Adapters::ActiveRecord::ManyToManySideload < Graphiti::Sideload:
     foreign_key.keys.first
   end
 
+  def inverse_filter
+    return @inverse_filter if @inverse_filter
+
+    inferred_name = infer_inverse_association
+
+    if inferred_name
+      "#{inferred_name.to_s.singularize}_id"
+    else
+      super
+    end
+  end
+
   def belongs_to_many_filter(scope, value)
     if polymorphic?
       clauses = value.group_by { |v| v["type"] }.map { |group|
@@ -36,8 +48,7 @@ class Graphiti::Adapters::ActiveRecord::ManyToManySideload < Graphiti::Sideload:
 
   def filter_for(scope, value, type = nil)
     scope
-      .preload(through_relationship_name)
-      .joins(through_relationship_name)
+      .includes(through_relationship_name)
       .where(belongs_to_many_clause(value, type))
   end
 
@@ -76,4 +87,11 @@ class Graphiti::Adapters::ActiveRecord::ManyToManySideload < Graphiti::Sideload:
     value = through_reflection.foreign_key.to_sym
     {key => value}
   end
+
+  def infer_inverse_association
+    through_class = through_reflection.klass
+
+    foreign_reflection = through_class.reflections[name.to_s.singularize]
+    foreign_reflection && foreign_reflection.options[:inverse_of]
+  end
 end

data/lib/graphiti/debugger.rb

@@ -10,6 +10,8 @@ module Graphiti
 
     class << self
       def on_data(name, start, stop, id, payload)
+        return [] unless enabled
+
         took = ((stop - start) * 1000.0).round(2)
         params = scrub_params(payload[:params])
 
@@ -24,7 +26,7 @@ module Graphiti
         end
       end
 
-      def on_data_exception(payload, params)
+      private def on_data_exception(payload, params)
         unless payload[:exception_object].instance_variable_get(:@__graphiti_debug)
           add_chunk do |logs, json|
             logs << ["\n=== Graphiti Debug ERROR", :red, true]
@@ -49,11 +51,11 @@ module Graphiti
         end
       end
 
-      def results(raw_results)
+      private def results(raw_results)
         raw_results.map { |r| "[#{r.class.name}, #{r.id.inspect}]" }.join(", ")
       end
 
-      def on_sideload_data(payload, params, took)
+      private def on_sideload_data(payload, params, took)
         sideload = payload[:sideload]
         results = results(payload[:results])
         add_chunk(payload[:resource], payload[:parent]) do |logs, json|
@@ -72,7 +74,7 @@ module Graphiti
         end
       end
 
-      def on_primary_data(payload, params, took)
+      private def on_primary_data(payload, params, took)
         results = results(payload[:results])
         add_chunk(payload[:resource], payload[:parent]) do |logs, json|
           logs << [""]
@@ -90,6 +92,8 @@ module Graphiti
       end
 
       def on_render(name, start, stop, id, payload)
+        return [] unless enabled
+
         add_chunk do |logs|
           took = ((stop - start) * 1000.0).round(2)
           logs << [""]

data/lib/graphiti/errors.rb

@@ -366,6 +366,20 @@ module Graphiti
       end
     end
 
+    class UndefinedIDLookup < Base
+      def initialize(resource_class)
+        @resource_class = resource_class
+      end
+
+      def message
+        <<~MSG
+          Tried to resolve #{@resource_class} with an :id filter, but the filter was nil.
+          This can result in unscoping a query, which can cause incorrect values to be
+          returned which may or may not bypass standard access controls.
+        MSG
+      end
+    end
+
     class UnknownAttribute < AttributeError
       def message
         "#{super}, but could not find an attribute with that name."

data/lib/graphiti/request_validator.rb

@@ -6,18 +6,18 @@ module Graphiti
       :deserialized_payload,
       to: :@validator
 
-    def initialize(root_resource, raw_params)
-      @validator = ValidatorFactory.create(root_resource, raw_params)
+    def initialize(root_resource, raw_params, action)
+      @validator = ValidatorFactory.create(root_resource, raw_params, action)
     end
 
     class ValidatorFactory
-      def self.create(root_resource, raw_params)
-        case raw_params["action"]
-        when "update" then
+      def self.create(root_resource, raw_params, action)
+        case action
+        when :update then
           RequestValidators::UpdateValidator
         else
           RequestValidators::Validator
-        end.new(root_resource, raw_params)
+        end.new(root_resource, raw_params, action)
       end
     end
   end

data/lib/graphiti/request_validators/validator.rb

@@ -3,10 +3,11 @@ module Graphiti
     class Validator
       attr_reader :errors
 
-      def initialize(root_resource, raw_params)
+      def initialize(root_resource, raw_params, action)
         @root_resource = root_resource
         @raw_params = raw_params
         @errors = Graphiti::Util::SimpleErrors.new(raw_params)
+        @action = action
       end
 
       def validate
@@ -68,6 +69,11 @@ module Graphiti
 
       def typecast_attributes(resource, attributes, payload_path)
         attributes.each_pair do |key, value|
+          # Only validate id if create action, otherwise it's only used for lookup
+          next if @action != :create &&
+            key == :id &&
+            resource.class.config[:attributes][:id][:writable] == false
+
           begin
             attributes[key] = resource.typecast(key, value, :writable)
           rescue Graphiti::Errors::UnknownAttribute

data/lib/graphiti/resource/dsl.rb

@@ -5,6 +5,7 @@ module Graphiti
 
       class_methods do
         def filter(name, *args, &blk)
+          name = name.to_sym
           opts = args.extract_options!
           type_override = args[0]
 

data/lib/graphiti/resource/interface.rb

@@ -23,6 +23,9 @@ module Graphiti
 
         # @api private
         def _find(params = {}, base_scope = nil)
+          guard_nil_id!(params[:data])
+          guard_nil_id!(params)
+
           id = params[:data].try(:[], :id) || params.delete(:id)
           params[:filter] ||= {}
           params[:filter][:id] = id if id
@@ -52,6 +55,13 @@ module Graphiti
             end
           end
         end
+
+        def guard_nil_id!(params)
+          return unless params
+          if params.key?(:id) && params[:id].nil?
+            raise Errors::UndefinedIDLookup.new(self)
+          end
+        end
       end
     end
   end

data/lib/graphiti/resource_proxy.rb

@@ -93,7 +93,7 @@ module Graphiti
       original = Graphiti.context[:namespace]
       begin
         Graphiti.context[:namespace] = action
-        ::Graphiti::RequestValidator.new(@resource, @payload.params).validate!
+        ::Graphiti::RequestValidator.new(@resource, @payload.params, action).validate!
         validator = persist {
           @resource.persist_with_relationships \
             @payload.meta(action: action),
@@ -118,6 +118,7 @@ module Graphiti
     end
 
     def destroy
+      data
       transaction_response = @resource.transaction do
         metadata = {method: :destroy}
         model = @resource.destroy(@query.filters[:id], metadata)
@@ -135,6 +136,7 @@ module Graphiti
     end
 
     def update_attributes
+      data
       save(action: :update)
     end
 

data/lib/graphiti/runner.rb

@@ -9,8 +9,7 @@ module Graphiti
       @query = query
       @action = action
 
-      validator = RequestValidator.new(jsonapi_resource, params)
-
+      validator = RequestValidator.new(jsonapi_resource, params, action)
       validator.validate!
 
       @deserialized_payload = validator.deserialized_payload

data/lib/graphiti/sideload.rb

@@ -26,8 +26,8 @@ module Graphiti
       @foreign_key = opts[:foreign_key]
       @type = opts[:type]
       @base_scope = opts[:base_scope]
-      @readable = evaluate_flag(opts[:readable])
-      @writable = evaluate_flag(opts[:writable])
+      @readable = opts[:readable]
+      @writable = opts[:writable]
       @as = opts[:as]
       @link = opts[:link]
       @single = opts[:single]
@@ -426,6 +426,7 @@ module Graphiti
       Util::Class.namespace_for(klass)
     end
 
+    # TODO: call this at runtime to support procs
     def evaluate_flag(flag)
       return false if flag.blank?
 

data/lib/graphiti/version.rb

@@ -1,3 +1,3 @@
 module Graphiti
-  VERSION = "1.2.20"
+  VERSION = "1.2.28"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: graphiti
 version: !ruby/object:Gem::Version
-  version: 1.2.20
+  version: 1.2.28
 platform: ruby
 authors:
 - Lee Richmond
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2020-07-17 00:00:00.000000000 Z
+date: 2020-10-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jsonapi-serializable
@@ -162,6 +162,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: standard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.4.7
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.4.7
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
@@ -190,7 +204,7 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 1.0.beta.4
-description: 
+description:
 email:
 - richmolj@gmail.com
 executables:
@@ -248,7 +262,7 @@ files:
 - lib/graphiti/adapters/active_record/belongs_to_sideload.rb
 - lib/graphiti/adapters/active_record/has_many_sideload.rb
 - lib/graphiti/adapters/active_record/has_one_sideload.rb
-- lib/graphiti/adapters/active_record/inferrence.rb
+- lib/graphiti/adapters/active_record/inference.rb
 - lib/graphiti/adapters/active_record/many_to_many_sideload.rb
 - lib/graphiti/adapters/graphiti_api.rb
 - lib/graphiti/adapters/null.rb
@@ -327,7 +341,7 @@ homepage: https://github.com/graphiti-api/graphiti
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -343,7 +357,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.0.6
-signing_key: 
+signing_key:
 specification_version: 4
 summary: Easily build jsonapi.org-compatible APIs
 test_files: []